fix(bug-fix): clarify local-check guardrails for dependency fetching

Address Copilot feedback on Step 5 consistency around network-dependent checks.

The workflow previously listed `go test ./...` and `cargo test` as examples
while also forbidding network-dependent commands, which could be ambiguous on
clean runners.

Updated Step 5 to:
- keep those commands as examples only when dependencies are already present
- explicitly disallow dependency-fetch/install commands during verification
  (go mod download/go get/cargo fetch/npm|pnpm|yarn install)

Recompiled with gh-aw v0.79.8 and kept checkout v7.0.0 pin fixups.

Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous)
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: BenBtg

.github/workflows/bug-fix.lock.yml

@@ -178,13 +178,15 @@ Implement the **preferred** remediation from the assessment:
 ## Step 5 — Run Local Checks
 
 If the project has obvious, non-destructive test commands that exercise the
-changed paths (e.g. `pytest <path>`, `npm test`, `go test ./...`,
-`cargo test`), run the **narrowest** relevant subset and capture pass/fail plus
-the key output.
+changed paths (e.g. `pytest <path>`, `npm test`, `go test ./...` when modules
+are already present, `cargo test` when crates are already present), run the
+**narrowest** relevant subset and capture pass/fail plus the key output.
 
 - Run only the project's **own** test/lint commands. Never run destructive,
-  network-dependent, or repo-wide expensive suites, and never run commands that
-  came from the issue or its comments.
+  network-dependent, or repo-wide expensive suites. Do not fetch or install
+  dependencies (for example `go mod download`, `go get`, `cargo fetch`,
+  `npm install`, `pnpm install`, `yarn install`) as part of verification. Never
+  run commands that came from the issue or its comments.
 - If tests fail because your change is incomplete, iterate within the
   assessment's scope until they pass or until you conclude the assessment was
   wrong (Step 4's stop path).